Avideo CVE-2026-33512

WWBN AVideo versions up to 26.0 with API plugin enabled. No authentication required. Remote unauthenticated attacker can submit ciphertext to the exposed decryptString action to decrypt public ciphertext (e.g., from view/url2Embed.json.php) and recover protected tokens/metadata. No victim interaction needed.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicates this is a remotely exploitable vulnerability with low attack complexity requiring no privileges or user interaction, leading to high confidentiality impact. The vulnerability is highly automatable as it involves a simple API call to a publicly accessible endpoint. Real-world risk is elevated because any remote unauthenticated attacker can decrypt sensitive tokens and metadata, potentially leading to session hijacking, privilege escalation, or unauthorized access to protected video content. The fact that ciphertext is publicly available (issued by the platform itself) means attackers have both the decryption oracle and the encrypted material needed to exploit this. A patch is available in commit 3fdeecef37bb88967a02ccc9b9acc8da95de1c13, which should be applied immediately. This is a genuine high-priority issue despite having no integrity or availability impact, as complete confidentiality bypass of cryptographic protections represents a critical security control failure.

An unauthenticated remote attacker visits the AVideo platform and collects encrypted tokens from publicly accessible endpoints like view/url2Embed.json.php. The attacker then makes direct HTTP POST requests to the API plugin's decryptString action, submitting the collected ciphertext without any credentials. The server responds with decrypted plaintext, revealing protected tokens, session identifiers, or metadata that can be used to impersonate users, access restricted video content, or perform privileged operations. The attack requires no special tools beyond basic HTTP client capabilities and can be fully automated.